NIXPKGS-2026-1396

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42235

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: XSS via MCP OAuth client

• https://github.com/n8n-io/n8n/security/advisories/GHSA-537j-gqpc-p7fq x_refsource_CONFIRM

---

n8n

• ==>= 2.17.0, < 2.17.4
• ==>= 2.18.0, < 2.18.1
• ==< 1.123.32

NIXPKGS-2026-1395

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-7776

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored package akkuPackages.chibi-char-set-boundary 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Boundary Workers Vulnerable to Denial of Service During TLS Handshake

• https://discuss.hashicorp.com/t/hcsec-2026-11-boundary-workers-vulnerable-to-de…

---

Boundary

• <0.21.3

Boundary Enterprise

• <0.21.3

NIXPKGS-2026-1394

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-7723

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Proof-of-Concept (P)
• Remediation Level (RL): Official Fix (O)
• Report Confidence (RC): Confirmed (C)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  4 references

  • VDB-360899 | CTI Indicators (IOB, IOC, …
  • Submit #807256 | PerfectHQ Perfect <=3.…
  • https://github.com/PrefectHQ/prefect/re…
  • https://github.com/PrefectHQ/prefect/
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

PrefectHQ prefect WebSocket Endpoint in missing authentication

• VDB-360899 | PrefectHQ prefect WebSocket Endpoint in missing authentication vdb-entry
• https://gist.github.com/nedlir/f1ab8aa038aafbcc6beeef21fab1d74f exploit
• https://github.com/PrefectHQ/prefect/pull/20372 issue-trackingpatch
• https://github.com/PrefectHQ/prefect/commit/f8afecadf88ea5f73694dafa3a365b9d8fa… patch

Ignored references (4)

• VDB-360899 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #807256 | PerfectHQ Perfect <=3.6.13 Missing Critical Step in Authentication third-party-advisory
• https://github.com/PrefectHQ/prefect/releases/tag/3.6.14 patch
• https://github.com/PrefectHQ/prefect/ product

---

prefect

• ==3.6.14
• ==3.6.11
• ==3.6.2
• ==3.6.13
• ==3.6.4
• ==3.6.9
• ==3.6.8
• ==3.6.0
• ==3.6.10
• ==3.6.12
• ==3.6.1
• ==3.6.3
• ==3.6.5
• ==3.6.7
• ==3.6.6

NIXPKGS-2026-1393

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-7779

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Proof-of-Concept (P)
• Remediation Level (RL): Not Defined (X)
• Report Confidence (RC): Reasonable (R)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored package open5gs-webui 1 month, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • VDB-360976 | CTI Indicators (IOB, IOC, …
  • Submit #806249 | Open5gs UDM v2.7.7 Den…
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of service

• VDB-360976 | Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of service technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4418 issue-trackingexploit

Ignored references (3)

• VDB-360976 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #806249 | Open5gs UDM v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.1
• ==2.7.4
• ==2.7.7
• ==2.7.0
• ==2.7.3
• ==2.7.5
• ==2.7.6
• ==2.7.2

NIXPKGS-2026-1392

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42230

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Open Redirect in MCP OAuth Consent Flow

• https://github.com/n8n-io/n8n/security/advisories/GHSA-f6x8-65q6-j9m9 x_refsource_CONFIRM

---

n8n

• ==>= 2.17.0, < 2.17.4
• ==< 1.123.32
• ==>= 2.18.0, < 2.18.1

NIXPKGS-2026-1390

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42229

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: SQL Injection in SeaTable Node

• https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp x_refsource_CONFIRM

---

n8n

• ==>= 2.17.0, < 2.17.4
• ==< 1.123.32
• ==>= 2.18.0, < 2.18.1

NIXPKGS-2026-1389

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42144

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)

• https://github.com/GreycLab/CImg/security/advisories/GHSA-4663-63fm-44gc x_refsource_CONFIRM
• https://github.com/GreycLab/CImg/issues/478 x_refsource_MISC
• https://github.com/GreycLab/CImg/commit/4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d x_refsource_MISC
• https://github.com/GreycLab/CImg/releases/tag/v.3.7.5 x_refsource_MISC

---

CImg

• ==< 4ca26bce4d8c61fcd1507d5f9401b9fb1222c27d

NIXPKGS-2026-1391

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42234

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Python Task Runner Sandbox Escape

• https://github.com/n8n-io/n8n/security/advisories/GHSA-44v6-jhgm-p3m4 x_refsource_CONFIRM

---

n8n

• ==>= 2.17.0, < 2.17.4
• ==>= 2.18.0, < 2.18.1
• ==< 1.123.32

NIXPKGS-2026-1388

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-7535

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Proof-of-Concept (P)
• Remediation Level (RL): Not Defined (X)
• Report Confidence (RC): Reasonable (R)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  4 references

  • VDB-360352 | CTI Indicators (IOB, IOC, …
  • Submit #804291 | Open5GS AMF V2.7.7 Den…
  • Submit #804303 | Open5GS AMF v2.7.7 Den…
  • https://github.com/open5gs/open5gs/
  1 month, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Open5GS transfer-update denial of service

• VDB-360352 | Open5GS transfer-update denial of service technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4399 issue-trackingexploit

Ignored references (4)

• VDB-360352 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #804291 | Open5GS AMF V2.7.7 Denial of Service third-party-advisory
• Submit #804303 | Open5GS AMF v2.7.7 Denial of Service (Duplicate) third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.1
• ==2.7.4
• ==2.7.7
• ==2.7.0
• ==2.7.3
• ==2.7.5
• ==2.7.6
• ==2.7.2

NIXPKGS-2026-1387

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-7724

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Proof-of-Concept (P)
• Remediation Level (RL): Official Fix (O)
• Report Confidence (RC): Confirmed (C)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 3 weeks ago
• @LeSuisse ignored
  5 references

  • VDB-360900 | CTI Indicators (IOB, IOC, …
  • Submit #807303 | PerfectHQ Perfect >=3.…
  • https://github.com/PrefectHQ/prefect/re…
  • https://github.com/PrefectHQ/prefect/
  • https://linear.app/prefect/issue/OSS-78…
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

PrefectHQ prefect Webhook/Notification validate_restricted_url toctou

• VDB-360900 | PrefectHQ prefect Webhook/Notification validate_restricted_url toctou technical-descriptionvdb-entry
• https://github.com/PrefectHQ/prefect/pull/21591 issue-trackingpatch
• https://gist.github.com/nedlir/fa99777e8989414585d08c3625bf044a exploit
• https://github.com/PrefectHQ/prefect/commit/7c70ac54a5e101431d83b9f2681ec88d5e0… patch

Ignored references (5)

• VDB-360900 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #807303 | PerfectHQ Perfect >=3.6.26 Time-of-check Time-of-use third-party-advisory
• https://linear.app/prefect/issue/OSS-7874/fix-dns-rebinding-toctou-bypass-in-va… issue-tracking
• https://github.com/PrefectHQ/prefect/releases/tag/3.6.28.dev2 patch
• https://github.com/PrefectHQ/prefect/ product

---

prefect

• ==3.6.28.dev2
• ==3.6.28.dev1